2.7
Low
CVE-2025-12654 The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory…
Description
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and including, 0.9.120. This is due to the check_filesystem_permissions() function not properly restricting the directories that can be created, or in what location. This makes it possible for authenticated attackers, with Administrator-level access and above, to create arbitrary directories.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Migration, Backup, Staging – WPvivid Backup & Migration 0.9 | earliest → 0.9.120 | No fix stated |
| WPvivid — Backup, Migration & Staging 0.9 | earliest → 0.9.120 | No fix stated |
Other CVEs of Migration, Backup, Staging – WPvivid Backup & Migration
The 5 CVEs of Migration, Backup, Staging – WPvivid Backup & Migration →
CVE-2026-1357
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated…
9.8
Critical
CVE-2025-5961
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads…
7.2
High
CVE-2024-13869
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads…
7.2
High
CVE-2024-10962
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up…
8.8
High